CVE-2026-28423: Statamic CMS SSRF Vulnerability

CVE-2026-28423 Overview

CVE-2026-28423 is a Server-Side Request Forgery (SSRF) vulnerability in Statamic, a Laravel and Git powered content management system (CMS). When Glide image manipulation is configured to run in insecure mode (not the default configuration), the image proxy can be exploited by unauthenticated attackers to force the server to send HTTP requests to arbitrary URLs. This can be achieved either through direct URL manipulation or via the watermark feature, potentially allowing access to internal services, cloud metadata endpoints, and other hosts reachable from the vulnerable server.

Critical Impact

An unauthenticated attacker can leverage this SSRF vulnerability to access internal services, cloud provider metadata endpoints (such as AWS IMDSv1), and other network resources reachable from the Statamic server, potentially leading to sensitive data exposure and lateral movement within the infrastructure.

Affected Products

• Statamic CMS versions prior to 5.73.11
• Statamic CMS versions prior to 6.4.0
• Statamic installations with Glide image manipulation configured in insecure mode

Discovery Timeline

• 2026-02-27 - CVE-2026-28423 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28423

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The flaw exists within Statamic's Glide image manipulation functionality when operating in insecure mode. Glide is an image manipulation library that processes images on-the-fly, and when improperly secured, it can be coerced into making outbound HTTP requests to attacker-controlled destinations.

The vulnerability allows an unauthenticated user to abuse the image proxy endpoint in two distinct ways: by directly specifying arbitrary URLs for image processing, or by leveraging the watermark feature to reference external resources. In both cases, the server will initiate HTTP requests to the specified targets, effectively turning the Statamic server into a proxy for the attacker.

The impact of this vulnerability is significant because it can be used to:

• Access cloud provider metadata services (e.g., http://169.254.169.254/) to retrieve instance credentials
• Probe and interact with internal network services not exposed to the internet
• Bypass firewall restrictions by making requests from a trusted internal host
• Enumerate internal infrastructure and potentially access sensitive configuration data

Root Cause

The root cause of this vulnerability lies in insufficient input validation and access controls within the Glide image manipulation proxy when configured in insecure mode. The application fails to properly restrict or sanitize the URLs that can be processed by the image manipulation functionality, allowing user-supplied external URLs to be fetched server-side without adequate authorization checks.

When insecure mode is enabled, the Glide proxy does not enforce restrictions on the target URLs for image sources or watermark resources, enabling attackers to specify arbitrary endpoints including internal services, cloud metadata APIs, and external hosts.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious requests to the Glide image proxy endpoint, specifying internal or external URLs in the image source parameter or watermark configuration. The Statamic server will then make HTTP requests to these URLs on behalf of the attacker.

For example, an attacker could target the cloud metadata endpoint to retrieve temporary security credentials, or probe internal services to identify vulnerable applications within the network. The cross-scope nature of this vulnerability means that actions taken by the compromised server can affect external systems and services.

Detection Methods for CVE-2026-28423

Indicators of Compromise

• Unusual outbound HTTP requests from the Statamic server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• HTTP requests to cloud metadata endpoints such as 169.254.169.254 originating from the web server
• Abnormal traffic patterns to the Glide image proxy endpoint with external or internal URL parameters
• Log entries showing image processing requests with non-standard URL schemes or internal hostnames

Detection Strategies

• Monitor web application logs for Glide proxy requests containing suspicious URL parameters pointing to internal addresses or cloud metadata services
• Implement network-level detection for outbound HTTP requests from web servers to internal infrastructure or sensitive endpoints
• Deploy web application firewall (WAF) rules to detect and block SSRF patterns in image proxy requests
• Review Statamic configuration to verify Glide is not running in insecure mode

Monitoring Recommendations

• Enable verbose logging for the Glide image manipulation component to capture all processed URLs
• Set up alerts for outbound connections from the Statamic server to RFC 1918 private address ranges
• Monitor for access attempts to cloud provider metadata services from web application servers
• Implement egress filtering and logging to track all outbound HTTP requests from the CMS infrastructure

How to Mitigate CVE-2026-28423

Immediate Actions Required

• Upgrade Statamic CMS to version 5.73.11 or 6.4.0 or later immediately
• Review Glide configuration to ensure insecure mode is disabled (the secure mode is the default)
• Audit server logs for any evidence of exploitation attempts or successful SSRF attacks
• Implement network segmentation to limit the impact of potential SSRF exploitation

Patch Information

Statamic has released security patches addressing this vulnerability. Users should upgrade to the following versions:

• Statamic 5.x: Upgrade to version 5.73.11 or later - GitHub Release v5.73.11
• Statamic 6.x: Upgrade to version 6.4.0 or later - GitHub Release v6.4.0

For detailed information about the vulnerability and patch, refer to the GitHub Security Advisory GHSA-cwpp-325q-2cvp.

Workarounds

• Ensure Glide image manipulation is configured in secure mode (the default setting) rather than insecure mode
• Implement network egress filtering to prevent the Statamic server from making outbound requests to internal services or cloud metadata endpoints
• Deploy a web application firewall (WAF) with SSRF detection rules to block malicious requests to the Glide proxy
• Consider disabling the Glide image manipulation feature entirely if not required for your use case

# Configuration example
# Verify Glide is not running in insecure mode in your Statamic configuration
# Check config/statamic/assets.php or your environment configuration
# Ensure 'secure' => true for the Glide image manipulation settings

# Network egress filtering example (iptables)
# Block outbound requests to cloud metadata service from web server
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block outbound requests to common internal ranges
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP